Sigma Watch is free and independent. If it saves you time, keep it running. ☕ Buy me a coffee
SigmaWatch
Rule feed

Detection rules

Every rule tracked across all seven sources, newest updates first.

Source Rule Status Updated
suricata ET WEB_CLIENT Tech Support Scam Landing M2 2019-04-15 rev 4 2024-03-07
suricata ET MALWARE Possible CryptXXX Ransomware Renaming Encrypted File SMB v1 ASCII rev 2 2024-03-07
suricata ET PHISHING Possible Successful Apple Phish 2015-07-31 rev 6 2024-03-07
suricata ET MALWARE Inbound PowerShell Executing Base64 Decoded VBE from Temp 2018-11-29 rev 5 2024-03-07
suricata ET PHISHING Successful Amazon Phish 2016-10-27 rev 9 2024-03-07
suricata ET PHISHING Successful LocalBitcoins Cryptocurrency Exchange Phish Aug 30 2017 rev 4 2024-03-07
suricata ET PHISHING Apple Phishing Landing M2 Feb 13 2017 rev 4 2024-03-07
suricata ET PHISHING Successful Paypal Phish M1 2016-12-13 rev 4 2024-03-07
suricata ET WEB_CLIENT Tech Support Scam Landing Jul 19 2017 rev 4 2024-03-07
suricata ET MALWARE Win32/Tofsee Pharma Spam Template Active - Outbound Email Spam rev 2 2024-03-07
suricata ET MALWARE Possible Konni Encrypted Stage 2 Payload Inbound via HTTP rev 3 2024-03-07
suricata ET MALWARE HTML/Xbash Hex Encoded WScript.Shell Inbound - Stage 1 rev 3 2024-03-07
suricata ET PHISHING Successful Tectite Web Form Submission - Possible Phishing rev 4 2024-03-07
suricata ET MALWARE Possible Locky Ransomware Writing Encrypted File over - SMB and SMB-DS v1 ASCII rev 2 2024-03-07
suricata ET INFO ABBCCoin Checkin rev 2 2024-03-07
suricata ET PHISHING Successful Squirrelmail Phishing 2015-11-20 rev 6 2024-03-07
suricata ET MALWARE Quant Loader Download Response M2 rev 5 2024-03-07
suricata ET EXPLOIT Possible ETERNALBLUE Exploit M3 MS17-010 rev 4 2024-03-07
suricata ET EXPLOIT ETERNALBLUE Probe Vulnerable System Response MS17-010 rev 4 2024-03-07
suricata ET MALWARE [Fireeye] Backdoor.BEACON M6 rev 3 2024-03-07
suricata ET PHISHING Excel Online Phishing Landing Aug 09 2016 rev 6 2024-03-07
suricata ET VOIP H.323 in Q.931 Call Setup - Inbound rev 2 2024-03-07
suricata ET EXPLOIT Possible DOUBLEPULSAR Beacon Response rev 3 2024-03-07
suricata ET MALWARE Possible STEADYPULSE Webshell Accessed M1 rev 2 2024-03-07
suricata ET MALWARE REvil Exfil SFTP Certificate Inbound rev 2 2024-03-07
suricata ET MALWARE CobianRAT Screenshot Exfil to CnC rev 3 2024-03-07
suricata ET PHISHING [eSentire] Successful Generic Phish 2018-06-15 rev 3 2024-03-07
suricata ET PHISHING Successful Phish to Compromised Wordpress Site 2016-03-23 rev 8 2024-03-07
suricata ET ADWARE_PUP UCMore Spyware Reporting rev 10 2024-03-07
suricata ET PHISHING Successful HM Revenue Phish 2016-10-06 rev 7 2024-03-07
suricata ET MALWARE Likely Malicious Windows SCT Download MSXMLHTTP M2 rev 5 2024-03-07
suricata ET PHISHING Successful Generic Credit Card Information Phish Oct 10 2017 rev 4 2024-03-07
suricata ET WEB_CLIENT JS ShellWindows/AddInProcess Win10 DeviceGuardBypass Inbound rev 3 2024-03-07
suricata ET MALWARE Locky Ransomware Writing Instructions via SMB rev 2 2024-03-07
suricata ET PHISHING Generic Encoded Phishing Landing 2021-03-10 rev 3 2024-03-07
suricata ET MALWARE Bitter RAT TCP CnC Beacon rev 2 2024-03-07
suricata ET PHISHING Successful Apple Phish 2016-03-09 rev 5 2024-03-07
suricata ET MALWARE Sharik/Smoke Loader Receiving Payload rev 4 2024-03-07
suricata ET PHISHING Successful Exmo Cryptocurrency Exchange Phish Aug 28 2017 rev 4 2024-03-07
suricata ET PHISHING Possible Successful Bank of America Phishing Domain Feb 02 2017 rev 5 2024-03-07